When
users forget their Unix passwords you're likely to get the request to
unlock their accounts. You might be surprised to see in SMIT that the
account is not locked:

Lock
/ Unlock a User's Account

*
User NAME
testuser

Is
this user ACCOUNT LOCKED? false

Then you change the user's password and you have a happy user logging in
again.

Three strikes and you're out

If
the user couldn't log in, why did AIX report the account was not
locked? The problem was that the user had exceeded his number of
unsuccessful logins. Once again, in SMIT you can see when you add or
Change a user:

Number
of FAILED LOGINS before user account is locked[3]

In
the example above, this is set to 3. This field is called
loginretries on the lsuser command.

You can see how close the
user is to the threshold via the lsuser command:

lsuser -a loginretries unsuccessful_login_count testuser

testuser loginretries=3 unsuccessful_login_count=2456

This
guy needs to think of a different password next time.

Not
locked out at all

This user hasn't been permanently
locked out of the system any more than you've been permanently locked out of your own house. He's just lost his key.

The account_locked
attribute is for users who are not supposed to login again. Ever.
That's for people who have left the company, for example. The
loginretries is different. It just sets a limit on how many times a user can forget a
password before coming cap in hand to the friendly AIX sys admin for
some help.

You can reset the user's failed login count in SMIT:

Reset User's Failed
Login Count

Or
you could do it on the command line using chuser:

chuser unsuccessful_login_count=0 testuser

When you change a password for a user using the passwd command, that automatically resets the unsuccessful_login_count to zero. That's clever, isn't it?

Facial muscles advice for the AIX Sys Admin

By the way, when users are repeat offenders with forgetting their passwords, it's a real art to show compassion while maintaining just the right hint of ever-so-slight annoyance. Most people err on the side of the latter, which is probably OK. It's not easy combining a sincere smile and a frown all in the one expression, but think how many muscles get exercised when you try.